file upload security

Discussion in 'Security' started by promotingspace.net, Feb 2, 2008.

  1. #1
    Hi
    I want to run a file upload service but worry about some matters
    1. if someone uploads a php file, can he read my other files? if I have config files with database details, then they can easily hack my site ! ???
    any suggestions?
     
    promotingspace.net, Feb 2, 2008 IP
  2. Colbyt

    Colbyt Notable Member

    Messages:
    3,224
    Likes Received:
    185
    Best Answers:
    0
    Trophy Points:
    210
    #2
    You need to restrict the file types to thing that can not harm your site or server.

    All executables must be in a zipped file at a minimum.
     
    Colbyt, Feb 2, 2008 IP
  3. promotingspace.net

    promotingspace.net Peon

    Messages:
    361
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #3
    what are executable file types?
    exe , bat , php , phpx , aspx , asp ,
    what elsedo you know?
     
    promotingspace.net, Feb 2, 2008 IP
  4. Colbyt

    Colbyt Notable Member

    Messages:
    3,224
    Likes Received:
    185
    Best Answers:
    0
    Trophy Points:
    210
    #4
    That covers most of the ones that I know. I'm sure we both missed a couple.

    If you are just going to run an upload service ban everything that is not zipped.

    If it isn't filename.zip you don't take it.
     
    Colbyt, Feb 2, 2008 IP
  5. Kaizoku

    Kaizoku Well-Known Member

    Messages:
    1,261
    Likes Received:
    20
    Best Answers:
    1
    Trophy Points:
    105
    #5
    Why not block all exept the image extensions?
     
    Kaizoku, Feb 2, 2008 IP
  6. Ladadadada

    Ladadadada Peon

    Messages:
    382
    Likes Received:
    36
    Best Answers:
    0
    Trophy Points:
    0
    #6
    Requiring certain extensions is a good start and definitely worthwhile implementing but not completely secure.

    If an attacker uploads a PHP script with a .jpg extension and then finds a local file inclusion vulnerability on your site he can include the PHP code stored in his .jpg file in one of your scripts. This means that a local file inclusion vulnerability, which is not usually enough to gain control of a site, has been escalated to a full takeover thanks to being able to upload PHP with a .jpg extension.

    In addition to enforcing the file extension, you should also check the mime-type of any uploaded files and reject them if they aren't one of a specific list.
     
    Ladadadada, Feb 10, 2008 IP